This Data Processing Agreement forms part of the agency's Property Media UK order form or services agreement when that document incorporates this version by reference. The order form identifies the agency, services, start date and commercial terms.
Parties, definitions and scope
Controller: the estate or letting agency identified as the Customer in the applicable order form or services agreement.
Processor: Newcastle Residential Holdings Ltd, trading as Property Media UK, company number 13960545, whose registered office is Clavering Place, Clavering House, Newcastle upon Tyne, England, NE1 3NG.
This agreement applies where the Processor handles personal data on the Controller's behalf in providing the contracted Property Media UK services. “Data Protection Law” means the UK GDPR, Data Protection Act 2018, Privacy and Electronic Communications Regulations 2003 and other applicable UK data-protection legislation, each as amended.
Terms including controller, processor, data subject, personal data, personal data breach, processing and supervisory authority have the meanings given by Data Protection Law.
Documented instructions and compliance
The Processor shall process personal data only on the Controller's documented instructions, including the order form, configured service settings, authorised support requests and this agreement, unless UK law requires otherwise. Where legally permitted, the Processor will inform the Controller before carrying out processing required by law.
If the Processor reasonably believes an instruction infringes Data Protection Law, it will notify the Controller and may suspend the affected processing until the parties resolve the issue. The Processor will not sell customer personal data, use it for unrelated advertising or combine it with another agency's records.
The Controller is responsible for the lawfulness, fairness, accuracy and transparency of its processing; its applicant-facing notices and lawful bases; the questions it configures; its decisions about applicants; and ensuring it does not instruct the Processor to collect information that is excessive for the purpose.
Confidentiality and security
The Processor will ensure that personnel authorised to handle personal data are bound by confidentiality obligations and receive access only where necessary for their role.
Taking account of the state of the art, implementation cost, processing context and risk, the Processor will maintain appropriate technical and organisational measures. The current measures are summarised in Schedule 3. The Processor may improve or replace a measure provided that the overall level of protection is not materially reduced.
Subprocessors
The Controller gives general written authorisation for the Processor to use the subprocessors listed in Schedule 2 for the relevant enabled services. The Processor remains responsible for each subprocessor's performance of its data-protection obligations and will impose materially equivalent protections by written contract.
The Processor will give at least 30 days' notice before appointing or replacing a subprocessor that will handle customer personal data, except where urgent replacement is reasonably necessary for security or service continuity. The Controller may object on reasonable data-protection grounds within 14 days. The parties will work in good faith on a practical resolution; if none is available, the Controller may stop the affected optional feature or terminate the affected service.
Data-subject requests
Taking account of the nature of the processing, the Processor will provide reasonable technical and organisational assistance so the Controller can respond to requests concerning access, rectification, erasure, restriction, portability, objection and automated decision-making.
If the Processor receives a request relating to Controller data, it will not respond on the merits unless authorised or legally required. It will direct the person to the Controller where practical and notify the Controller without undue delay. The Controller remains responsible for verifying identity, applying exemptions and responding within the legal deadline.
Breaches, DPIAs and regulatory assistance
The Processor will notify the Controller without undue delay after becoming aware of a confirmed personal data breach affecting Controller data. Where available, the notice will describe the nature of the breach, likely consequences, affected records and people, measures taken or proposed, and a contact for follow-up. Information may be supplied in phases as the investigation develops.
The Processor will take reasonable steps to contain, investigate and remediate the incident and will preserve appropriate evidence. The Controller is responsible for deciding whether to notify the ICO or affected people.
Taking account of the processing and information available, the Processor will reasonably assist with security obligations, breach assessments, data protection impact assessments and prior consultation with the ICO. Additional work beyond standard service support may be charged at an agreed rate unless caused by the Processor's breach of this agreement.
Return, retention and deletion
During the service term, the Controller may use available export and deletion functions or issue a verified written instruction. On termination, and at the Controller's choice, the Processor will return or delete Controller personal data unless UK law requires retention.
Unless the order form specifies otherwise, the Processor will make an export available for 30 days after termination, delete Controller personal data from active systems within 30 days after that export period, and allow encrypted residual backups to expire through the ordinary secure rotation within a further 90 days. Data isolated in backups will not be restored except for disaster recovery and will remain protected until deletion.
The Processor may retain minimal records necessary to demonstrate compliance, resolve payment or security disputes, or meet a legal obligation, acting as an independent controller for that limited purpose.
Compliance information and audits
The Processor will make available information reasonably necessary to demonstrate compliance with Article 28 of the UK GDPR. This may include current security summaries, policies, provider assurance material, penetration-test summaries and responses to a proportionate due-diligence questionnaire.
If that information is insufficient, the Controller may conduct one audit in any 12-month period on at least 30 days' notice, during normal business hours and subject to confidentiality and security requirements. More frequent or urgent audits are allowed following a material incident or where required by the ICO. Audits must avoid access to another customer's information and unnecessary disruption.
International transfers
The Processor will not make a restricted transfer of Controller personal data unless it uses a lawful transfer mechanism. Depending on the destination and provider, this may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved EU Standard Contractual Clauses, or another mechanism permitted by Data Protection Law.
The Processor will provide reasonable information about relevant locations and safeguards and will carry out a transfer-risk assessment where required. A subprocessor may process data globally for security or network delivery only as described in its contract and subject to the applicable safeguard.
Liability, priority and law
Liability under this agreement is subject to the limits and exclusions in the main services agreement, except where Data Protection Law does not permit limitation. If this agreement conflicts with the main services agreement on processing personal data, this agreement prevails. If an applicable lawful transfer mechanism conflicts with this agreement, the transfer mechanism prevails for that transfer.
This agreement is governed by the law and jurisdiction stated in the main services agreement or, if none is stated, the laws of England and Wales and the courts of England and Wales.
Schedule 1 — details of processing
| Subject matter | Provision of Property Media UK's contracted property-media, enquiry, applicant-management, questionnaire, communication and related support services. |
|---|---|
| Duration | For the service term and the limited return, deletion and backup-expiry periods in clause 7. |
| Nature and purpose | Collecting, receiving, recording, structuring, matching, validating, hosting, retrieving, displaying, communicating, exporting, securing, supporting and deleting data to provide the configured services. |
| Data subjects | Prospective tenants and applicants; members of applicant groups; guarantors or referees where indicated; landlords and property owners; agency staff and authorised users; correspondents and support contacts. |
| Personal-data categories | Names and contact details; property and enquiry details; correspondence; preferences, budgets, move-in dates and household size; broad employment/study status; reference and guarantor availability; tenancy-length preference; viewing availability; workflow status; user-account, delivery, technical, security and audit data. |
| Special-category data | Not intended for the current pre-viewing workflow. The Controller must not configure collection of special-category or criminal-offence data without a written service amendment confirming purpose, lawful basis, condition, safeguards and retention. |
| Controller instructions | The order form, configured account and workflow settings, authorised use of service features, support requests and verified written instructions from authorised Controller contacts. |
Schedule 2 — approved subprocessors
Only providers relevant to features enabled for the Controller process the corresponding data. Production regions and transfer safeguards must be confirmed in the agency's completed order form or subprocessor register before live onboarding.
| Provider | Function | Data involved |
|---|---|---|
| Supabase | Database, authentication and storage infrastructure | Account, agency, enquiry, applicant, questionnaire, communication and audit records |
| Cloudflare | Application delivery, network security and Turnstile abuse prevention | Network identifiers, request metadata and application traffic |
| Resend | Transactional email delivery | Recipient, subject, message content and delivery metadata |
| Twilio | SMS or WhatsApp delivery where the feature is enabled | Telephone number, message content and delivery metadata |
| Netlify | Branded questionnaire gateway where configured | Network/request metadata and encrypted questionnaire traffic in transit |
Generative-AI providers are not authorised by this schedule to make applicant viewing or tenancy decisions. Any future applicant-data AI feature requires prior documentation, risk assessment, transparency and an updated subprocessor entry before activation.
Schedule 3 — security measures
- encrypted HTTPS connections and provider-managed encryption at rest;
- authenticated staff access, role checks and agency-scoped row-level access controls;
- cross-agency access denial, purpose-specific public links and hashed expiring questionnaire tokens;
- server-side provider credentials and restrictions against exposing secrets in browser code or logs;
- audit and delivery records for critical workflow activity and provider failures;
- input validation, rate limiting or abuse prevention on public entry points;
- separate records for immutable questionnaire snapshots and submitted responses;
- controlled software changes, dependency maintenance, backups and incident investigation procedures;
- data minimisation, staff confidentiality and access removal when no longer required.
Schedule 4 — execution details
The Processor accepts this agreement when it accepts an order form that incorporates it. The Controller accepts it through the authorised signatory named in that order form. The parties may also sign a separate counterpart containing the agency name, registered address, company number, signatory, signature and effective date.